[M3gA-Mind]

Removes the "reviewed-epic" release mode, so releases are cut only from this repo's main branch.

The mode let a release tag a reviewed PR's merge commit on an epic branch instead of main, through a reusable workflow in tinyhumansai/.github pinned at a commit that's only on that repo's epic branch (sdk-reviewed-epic-release@0cafb7a / module-reviewed-epic-release@6ed83b0). That split version lines and let releases carry code that isn't on main. The decision is that releases come only from the official repo's main.

Changes: .github/workflows/release.yml is restored to its state before 7f09f60 (the addition was additive). scripts/test-release-workflow.py now asserts that tag is the only dispatch input, that no reviewed-epic / release_mode / reviewed_pr remains, and that an epic dispatch resolves only tag and version, with jobs exactly [resolve, module-release]. 7 tests pass.

The ordinary main release path is unchanged: tag push, or dispatch with tag, through the shared release workflow, which already refuses a tag whose commit isn't an ancestor of origin/main.

Validation on the self-hosted Linux runner: the repo's release-workflow tests pass on this commit. Workflow syntax is checked by this PR's GitHub CI.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ffd2e8ef-dc2e-4c7d-b15f-fc36934bfb5d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 52e944a9c2c382f1f23e5ae92d40312df072722a

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: .github/workflow….
Pull request purpose (title): ci(release): release…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci(release): release only from main. This pull request removes the "reviewed-epic" release mode so releases are cut only from the repository's main branch, and updates the release-workflow tests to pin the narrowed contract. The latest-push delta could not be computed; the whole-pull-request diff is summarized here, not any push delta.

Unreviewed paths

• .github/workflows/release.yml

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

• Removed — Reviewed-epic release dispatch mode and inputs: Dispatch can no longer select a mode or name a reviewed PR; the workflow exposes only a tag input, so a release is defined solely by a tag on main. (.github/workflows/release.yml on:, .github/workflows/release.yml jobs:)
• Removed — Reviewed-epic release job and resolver validation branches: The second reusable workflow job and the mode/reviewed-PR validation and rejection logic are gone, narrowing permissions and leaving a single release path through the ordinary module-release workflow. (.github/workflows/release.yml jobs:)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered critique lane found no defect introduced by this change and reports the test file is consistent with the trimmed workflow.
• Lane summary: The test file is consistent with the trimmed release workflow: `run_resolve` forwards extra env vars via `**extra`, the new assertions match the current `release.yml` (single `tag` input, one `uses:` of the shared workflow, jobs `resolve` and `module-release`), and the removed `REVIEWED_RELEASE_SHA`/reviewed-epic assertions have no remaining callers. I found no defect introduced by this change. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered security lane found nothing reportable: no production code, workflow permission, or dependency changes, and removal of the extra read-permission job narrows exposure.
• Lane summary: This change only edits the Python test script that exercises the release workflow resolver; it removes the reviewed-epic test cases and the injected RELEASE_MODE/REVIEWED_PR environment variables, tightening the assertions to the ordinary tag-release route. No production code, workflow permission, or dependency changes, and the test-file edits match assertions about the workflow contents — I found nothing reportable. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered tests lane confirms the changed resolver's surviving behavior and the removal branches are pinned by exact-equality and negative assertions.
• Lane summary: The change deletes the reviewed-epic release path from `.github/workflows/release.yml` and rewrites the Python fixture tests to pin the surviving contract: the resolver emits exactly `tag=v0.5.2\nversion=0.5.2\n`, dispatch declares only a `tag` input, the workflow references exactly one `tinyhumansai/.github` reusable workflow, and jobs are limited to `resolve` and `module-release`. Those assertions can fail (they are exact-equality and negative `assertNotIn` checks over the workflow and resolver output), so the new behaviour — including the removal of the mode/PR validation and its rejection branches — is pinned. No remaining branch of the changed resolver is left unexercised, and the workflow change only narrows permissions and job set, so I found nothing reportable. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered description lane reports the description accurately covers both the workflow and test changes and notes no widened permissions, no newly unpinned action, and no untrusted context interpolated into a shell.
• Lane summary: The pull request removes the reviewed-epic release mode, restoring release.yml to its pre-7f09f60 state and updating the release-workflow tests accordingly; the description accurately covers both the workflow and test changes, and the workflows path rules show no widening of permissions, no newly unpinned action, and no untrusted context interpolated into a shell. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000053
• Tokens: 79476 input · 2011 output · 22528 cached · 300 embedding
• Updated: 2026-11-03T10:48:11Z

Head	State	Pass summary
52e944a9c2c3	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-03T10:48:11Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0001